How can I include zero/empty count buckets in tables/charts?

[Glenn]

I am trying to create a histogram/distribution graph of deal durations, for comparison between where the user is accessing a website from.

This search works more or less OK:

"search that returns reults with deal durations in field totalTime" | chart count(_raw) as "Num Deals" by totalTime span=100

totalTime is returned as an integer 0-3000, meaning ideally I would have 30 buckets. My problem is that some locations are very slow, and there are no durations below 800. The chart command does not create any rows for durations lower than 800 (ie. 0-100, 100-200, 200-300 etc up to 700-800 are all missing). This makes direct comparisons between graphs difficult, as they do not show the same scale.

Is there any way to force Splunk to create empty buckets (starting from zero) for charting as per my requirement?

Splunk version 4.1.5.

Cheers,

Glenn

[the_wolverine]

http://answers.splunk.com/answers/118496/fill-in-0-for-timechart-with-missing-values

[ytamura]

I'm assuming you are bucketing in terms of totalTime. What worked for me is the following search structure:

your search | chart count(totalTime) as "Num Deals" over totalTime span=100

Addendum: There's a function called makecontinuous that is supposed to do this, but I believe it actually just adds one to the bucket, which is somewhat misleading to a wider audience: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makecontinuous

[ytamura]

Strange, tried again on a simple search and it works for me. I'm on 4.2 by the way. In fact, I did something like your search and I'm still getting 0 buckets displayed.

The only way I'm not getting any 0 buckets is if I do:
search | bucket X span=100 | chart count by X

Perhaps this is a difference between Splunk versions...

[Glenn]

Hi, I don't think this works. It gives me the same kind of picture as before - empty buckets before the first one (ie. 0-100, 100-200 if first result is in 200-300 bucket) are not created or charted.